Sentry: Towards a Cross-Language Dynamic Analysis Framework for Hybrid Android Applications

Abstract

Hybrid Android applications combine native components with web content rendered in a WebView. Security-relevant behaviour can therefore cross the Android–JavaScript boundary through external page loading, bridge method exposure, or browser-side operations. We present Sentry, a dynamic analysis framework that pairs na- tive instrumentation with a page-level JavaScript probe. Sentry records WebView-related events on both the native Android side and the JavaScript side, for a trace analyser to inspect. We evaluate Sentry on 18 benchmarks drawn from the IWandroid and Hybrid- Droid suites. The results show that Sentry distinguishes calls to the original native bridge from JavaScript-side bridge mutations and preserves the ordering of bridge exposure, native updates, and bridge invocations occur.